abocn/kowalski
3
0
Fork 0
mirror of https://github.com/abocn/TelegramBot.git synced 2025-03-10 12:49:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix code scanning alert no. 1: Shell command built from environment values (#11)

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Lucas Gabriel 2024-09-28 18:44:00 -03:00 committed by GitHub
parent 37cb595999
commit 4ffb5c3972
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
commands/youtube.js
View File

@ -1,7 +1,7 @@
const { getStrings } = require('../plugins/checklang.js'); const { getStrings } = require('../plugins/checklang.js');
const { isOnSpamWatch } = require('../plugins/lib-spamwatch/spamwatch.js'); const { isOnSpamWatch } = require('../plugins/lib-spamwatch/spamwatch.js');
const spamwatchMiddleware = require('../plugins/lib-spamwatch/Middleware.js')(isOnSpamWatch); const spamwatchMiddleware = require('../plugins/lib-spamwatch/Middleware.js')(isOnSpamWatch);
const { exec } = require('child_process'); const { execFile } = require('child_process');
const os = require('os'); const os = require('os');
const fs = require('fs'); const fs = require('fs');
const path = require('path'); const path = require('path');
@ -17,9 +17,9 @@ function getYtDlpPath() {
return ytDlpPaths[platform] || ytDlpPaths.linux; return ytDlpPaths[platform] || ytDlpPaths.linux;
}; };
async function downloadFromYoutube(command) { async function downloadFromYoutube(command, args) {
return new Promise((resolve, reject) => { return new Promise((resolve, reject) => {
exec(command, (error, stdout, stderr) => { execFile(command, args, (error, stdout, stderr) => {
if (error) { if (error) {
reject({ error, stdout, stderr }); reject({ error, stdout, stderr });
} else { } else {
@ -39,7 +39,8 @@ module.exports = (bot) => {
const mp4File = `tmp/${userId}.mp4`; const mp4File = `tmp/${userId}.mp4`;
const cmdArgs = "--max-filesize 2G --no-playlist --merge-output-format mp4 -o"; const cmdArgs = "--max-filesize 2G --no-playlist --merge-output-format mp4 -o";
const videoFormat = "-f bestvideo+bestaudio"; const videoFormat = "-f bestvideo+bestaudio";
const dlpCommand = `${ytDlpPath} ${videoUrl} ${videoFormat} ${cmdArgs} ${mp4File}`; const dlpCommand = ytDlpPath;
const dlpArgs = [videoUrl, videoFormat, ...cmdArgs.split(' '), mp4File];
const downloadingMessage = await ctx.reply(strings.ytDownloading, { const downloadingMessage = await ctx.reply(strings.ytDownloading, {
parse_mode: 'Markdown', parse_mode: 'Markdown',
@ -47,7 +48,7 @@ module.exports = (bot) => {
}); });
try { try {
await downloadFromYoutube(dlpCommand); await downloadFromYoutube(dlpCommand, dlpArgs);
await ctx.telegram.editMessageText( await ctx.telegram.editMessageText(
ctx.chat.id, ctx.chat.id,